Orchestrata Ultimate / Specs / 033-autonomous-build-factory

033-autonomous-build-factory: Governed Autonomous Build Factory

Fable designs (research + tests + semantic anchors + a diagram); a decision-complete spec is frozen; tiered agents (haiku → sonnet → opus) build it autonomously in worktrees under deterministic, structurally-grounded governance. Humans are touched for vision, seed-design ratification, breaking changes, and adjudicating disclosed ambiguities.

At a glance

Reading this spec

The Governed Autonomous Build Factory describes how software is built with little human involvement under deterministic governance. A top-tier model designs the work (research, tests, semantic anchors and a diagram) and a decision-complete spec is frozen. Tiered agents (haiku, then sonnet, then opus) then build it autonomously in git worktrees. Humans are involved only for vision, ratification of the seed design, breaking changes and adjudicating ambiguities that the system discloses.

The spec argues that MCP tools are opt-in and the model ignores them, so governance has to be enforced at a boundary the model cannot route around; that retrieval, transformation, boilerplate and structural review belong to AST, knowledge graph and Prolog rather than to model tokens; and that correctness is a deterministic function of structurally grounded or requirement-derived facts, never of the model's self-report.

The sections are governance and authority (constitution, approved patterns, amendment authority, coupling budget, execution identity), the build pipeline (decision phase, execution phase, fast path), the execution loop and determinism boundary, storage, test discipline, incompleteness detection, the threat model and failure posture, a status-honest mapping to existing code, the build backlog and a decision register. Section 6 defines the requirements REQ-033-C1 to REQ-033-C5: an assumption ledger with an arbiter cascade, interpretation mutation, lexical and structural detectors, logical detectors, and a Definition of Ready that is a construction procedure rather than a checklist.

The key decisions are that the enforcement boundary is the committed worktree state, matched content-exactly against a registered set of governed writers and attested as in-toto link metadata; that gates fail closed under a declared failure policy; that there is one fact graph per project with facts keyed by worktree and commit, and Prolog is a stateless reasoning view; that semantic anchors derive from requirements, not code, and editing one is a constitutional act needing human ratification; that incompleteness is detected before the build, because completeness cannot be proven; and that every blocking decision carries its derivation and no agent promotes its own work.

In the code, the factory package is orchestrata_ultimate/factory, with citations spread thinly over many modules, such as orchestrata_ultimate/factory/anchors/evaluation, orchestrata_ultimate/factory/assumptions/ledger, orchestrata_ultimate/factory/detectors/engine, orchestrata_ultimate/factory/dor_procedure/validate and orchestrata_ultimate/factory/fastpath/classifier. The per-requirement view is on the RTM page.

The spec's status line reads Draft. It tracks 1 file and defines 10 requirement IDs. The full text follows below.

Measured coverage is 4 of 10 requirements cited by at least one @traces in src/ (40.0%), spread over 17 modules; the module citing the most of them is orchestrata_ultimate/factory/anchors/evaluation (1 requirements). In tests/, 0 requirements are cited by a test-side @traces.

Coverage gaps: 6 requirements have no citing symbol. The largest untraced groups are REQ-033-* (6). Untraced means no @traces names the ID; the behaviour may still exist in code that was never annotated. Test-side citations are thinner than code-side ones (0 against 4).

Requirements

Checkbox is the state recorded in the requirements checklist; Traced by is the count of src/ symbols whose @traces names the ID.

Code that traces this spec

Full spec text

Verbatim from specs/033-autonomous-build-factory/spec.md; headings are pushed down two levels.

SPEC-033: Governed Autonomous Build Factory

Metadata

• Spec ID: 033-autonomous-build-factory
• Title: Governed Autonomous Build Factory (deterministic exoskeleton for Claude)
• Author: Mohamed
• Status: Draft
• Created: 2026-07-23
• Priority: P1
• Components: Governance cascade, Build pipeline, Execution loop, Incompleteness detection, KG/Prolog storage, Test discipline
• Depends on: SPEC-001 (kernel), 007 (prolog-governance), 008 (knowledge-graph), 015 (plugin-sdk), 019 (intent-impact-analyzer), 020 (claude-code-harness), 025 (code-generation-drivers), 064 (git-worktree-tools), 072 (toolsearch), 106 (context-semantic-layer)
• Version: 0.4.0

Nature of this spec (read first). Prescriptive target, not documentation of existing code. Unbuilt components are planned tasks (§9), not defects. A finding is a design weakness only if no amount of building fixes it. "Not in the code yet" is a task.

docs/adr/ is authoritative for rationale. Every decision in this spec is recorded as an ADR with its context, rejected alternatives and consequences. This document states what was decided and what must be built; it does not re-argue why. Where the two disagree, the ADR wins and this spec is in error. ADR references are inline as [ADR-NNNN].

Revision 0.4.0 — folded the ADR register (ADR-0001…0033), the 2026-07-24 requirements-engineering and prior-art research, and a survey of the existing Prolog rulebases and governance hook. Design changes in this revision: edge accounting over the transitive closure and boundary changes reclassified as loosening [0021]; fast path now requires anchors unchanged [0023]; DoR delivered as a construction procedure, not a checklist [0028]; C4 promoted ahead of C2 and C2 given adversarial separation [0022]; C3 specified and tiered by measured precision [0029]; assumption matching given an explicit arbiter cascade [0024]; in-toto/SLSA adopted as the provenance format [0030]; admission-control contract adopted by the gate, wiring the dropped MODIFY [0032]; proof trees on every blocking decision [0031]; no agent merges its own work [0033]; no governance predicate may truncate its answer set [0026]; Prolog retained as the engine [0027].

Overview

What

Fable designs (research + tests + semantic anchors + a diagram); a decision-complete spec is frozen; tiered agents (haiku → sonnet → opus) build it autonomously in worktrees under deterministic, structurally-grounded governance. Humans are touched for vision, seed-design ratification, breaking changes, and adjudicating disclosed ambiguities.

Why

• MCP tools are opt-in — the model ignores them (a KG MCP server went unused). Governance must be enforced at a boundary the model cannot route around, not offered as a tool. [ADR-0001]
• Retrieval, transformation, boilerplate, and structural review are deterministic — they belong to AST/KG/Prolog, not to model tokens.
• Correctness is a deterministic function of structurally-grounded or requirement-derived facts — never of the model's self-report. [ADR-0008]

How

• Enforcement boundary = the committed worktree state [0001], matched content-exactly against a registered set of governed writers [0017], attested as in-toto link metadata [0030]. Factory gates fail closed under an explicit, declared failure policy [0002, 0032].
• One fact-graph per project [0003], facts keyed by (worktree, commit) [0004]; Prolog as a stateless reasoning view [0005] over a rule-driven, completeness-checked projection [0006].
• Incompleteness is detected before the build (§6) [0011], not discovered mid-build.
• Structural conformance is deterministic; semantic correctness is pinned by requirement-derived anchors [0012] and disclosed-ambiguity adjudication (§3).
• Every blocking decision carries its derivation [0031]; no agent promotes its own work [0033].

1. Governance & Authority

GLOBAL CONSTITUTION        immutable floor · explicit, enumerated, TESTED · changed ONLY by the human
GLOBAL APPROVED PATTERNS   shared design vocabulary (patterns as Prolog rules) · grows by human ratification
PROJECT KB (per project)   design contract + ratified amendments + human-approved local overrides
DESIGN CONTRACT (per change)  diagram + anchors + promoted rules for this change

Tiers: Human (vision, seed ratification, breaking changes, ambiguity adjudication, tie-break) · Fable (design authority; obedience-biased but escalation-biased on ambiguity — see §6) · Opus (independent blind reviewer; amendments need quorum=2; writes patterns, not pardons) · Sonnet (triage: impl-bug vs design-gap) · Haiku (execute strictly).

1.1 Amendment authority

• Asymmetric amendment [0009]. Tightening ⇒ quorum. Loosening ⇒ human. Direction is decided by a deterministic differential classifier, never by the amending quorum: run old and new rulebases over the accumulated fact ledger; new_accepts ⊆ old_accepts ⇒ tightening; any newly-accepted commit ⇒ loosening ⇒ human.
• The syntactic test is a sufficient condition only [0020]. A change the classifier cannot prove tightening goes to the human — "not provably tightening" is never treated as loosening-by-default nor as tightening-by-default; it is treated as undetermined, and undetermined escalates.
• Adjudications are promoted into the Project KB [0014] so the same question is never adjudicated twice.

1.2 Coupling budget (liveness)

Narrowing-equivalent refactors are quorum-only. The ratified contract pre-authorises an edge budget for cross-component dependencies. Per [0021]:

• Coupling is counted over the transitive reachability closure, not just declared direct edges, so indirection through an existing hop is visible.
• The budget is cumulative against trunk with an explicit repayment rule (coupling removed returns budget) — it does not refill per change.
• Component-boundary changes (merge / split / move) are loosening by definition ⇒ human ratification, regardless of how the edge count moves. (Merging two components makes a cross-component edge vanish; edge-count-only accounting scores that as a tightening.)

1.3 Constitutional invariants

• Constitution is explicit, enumerated, and tested (.pl + its own suite).
• "Lower never widens higher" is guaranteed by stratified negation [0010]: constitutional invariants MUST NOT depend, via negation-as-failure, on any extension_point/1 predicate. A meta-lint on .pl diffs enforces the stratification (B17).
• The governance rulebase bans dynamic predicate construction [0025]: no call/N on unbound goals, no assert/retract (facts come from the projection [0005]), no cut. This is what makes [0006]'s projection-completeness check and [0010]'s stratification lint decidable. The proof-tree meta-interpreter (B19) is the single explicitly allowlisted exception [0031].
• No governance predicate may return a truncated answer set [0026]. Where recursion over a possibly-cyclic graph is required, terminate by construction (visited-set / simple-path bounding), never by capping answers. A predicate that can return some of the truth is a false-green generator.
• Prolog is retained as the reasoning engine [0027]. Datalog/Rego/Cedar alternatives were evaluated and rejected: they achieve their static guarantees by removing recursion, which our transitive-closure knowledge-graph queries require, and none offers SWI's incremental tabling.

1.4 Execution identity and escalation

• Three-UID execution model [0018]: agent, gate/trusted runner, and promotion identities are distinct OS identities, not roles asserted in software.
• No agent merges its own work [0033]. Merge requires an identity distinct from the authoring identity, enforced structurally by [0018]. Dispatch additionally gates on duplication (the same requirement already in flight or promoted) and staleness (trunk moved within the task's impact set); both refusals are recorded events, never silent no-ops.
• Escalation is an SLO with numbers (K attempts, rate threshold — human-ratified constants, §9/B10). Deadlock (Opus↔Fable, human unavailable) ⇒ block-and-park with timeout; never silently drop or widen.
• Every decision that blocks work, escalates a tier, or is offered for human adjudication carries its proof tree [0031] — for a denial, the enumerated failing preconditions of each candidate rule. A bare verdict is not an acceptable gate output.

2. Build Pipeline

Decision phase. Fable produces ONE design fact base yielding: the diagram, the DAG schedule (tiers = parallel levels = merge order), red-first failing tests, semantic anchors, validators, the migration plan, the strict structural contract, and the assumption ledger.

• Semantic anchors are requirement-derived, not code-derived [0012]. The ratified artifact SHALL carry, per acceptance criterion: concrete input→output examples, and where applicable properties / metamorphic invariants and — for amendments — a differential oracle (prior behaviour). These are deterministic and independent of the implementation, so they pin intent in a way code-derived checks (incl. mutation testing) structurally cannot. The size of the semantic hole is a dial set by how many anchors you write, not a fixed ceiling.
• Anchors are constitution-tier [0013]: editing an anchor is a constitutional act requiring human ratification. Otherwise an agent blocked by an anchor can launder the block by weakening the anchor.
• Anchor classes are ranked for amendments [0016]: where a differential oracle exists it outranks examples, which outrank properties, for deciding whether behaviour changed.
• Diagram certification is bidirectional: every enforced element is rendered (no enforced-but-unratified design) and every rendered element is enforced, or is visibly marked non-contract (no ratified-but-unenforced false assurance).

Definition of Ready = no incompleteness detector fires (§6) — not "boxes are filled" [0011]. DoR is necessary, not sufficient [0015]. Plus: every requirement → design node + contract + ≥1 failing test + ≥1 anchor; every one-way-door → ADR.

Execution phase. Greenfield → generate from the diagram; amend → apply the migration plan. Parallel worktrees by DAG level (SPEC-064); merge level-by-level with an integrated-trunk re-gate.

Fast path. A change the impact query proves stays within contract skips the legislature — but only if the anchors of every touched acceptance criterion remain both satisfied and unchanged [0023]. "Within contract" is a structural proof; behaviour can change arbitrarily inside it, and the fast path is by construction the highest-frequency route through the system. Any change requiring an anchor edit is by definition not fast-path, and the anchor edit itself requires human ratification [0013].

A worked end-to-end cost trace (tokens/time) for one modal change is required before general rollout.

3. Execution loop & the determinism boundary

write → gate reviews {AST≡design ∧ test-review ∧ anchors} → pass? next : {self-fix | escalate}

What is deterministic: component existence, public-signature match, cross-component dependency edges, complexity thresholds, test structure, coverage, trace validity [0007] (traced unit's AST lies within the cited design node's contract and is reached by a test asserting on it), and anchor satisfaction (examples/properties/oracles hold).

What is NOT deterministic — stated plainly [0008]: semantic intent beyond the anchors. A self-consistent wrong-code + wrong-test pair born of one misreading passes structure, coverage, and even a 100% mutation score (mutants derive from the code, so mutation testing certifies test sensitivity, never correctness). Trace validation relocates this circularity into test quality; it does not break it. What actually pins intent is: requirement-derived anchors (§2), interpretation mutation (§6), and human adjudication of disclosed ambiguities. Model-judged seams (Sonnet's triage, "patterns exhausted", "decision-complete") are labelled as such and human-sampled, never presented as deterministic.

3.1 State-based enforcement and its trust boundary

At commit, a full-filesystem tree diff (not git status) is matched content-exactly — every governed write records the resulting content hash, and the committed tree must equal the accumulation of registered results [0001]. Deltas with no registered producer are rejected. Legitimate non-agent writers (formatters, codegen, pre-commit hooks) are registered governed writers — an allowlist of state producers, not a denylist of commands. The honest claim is therefore: the boundary is the registered producer set, not "the model cannot act".

Governed writers are attested pure functions [0017]: a writer declares its inputs and outputs, and the gate verifies the declaration against reality — a writer touching an undeclared input fails verification.

Provenance uses in-toto / SLSA [0030], not a bespoke format:

• a governed writer's attestation is in-toto link metadata — signed, declaring materials and products, bound to the executing identity;
• pipeline stage ordering and the governed-writer allowlist are an in-toto layout with authorized functionaries, matching the three-UID model [0018];
• cross-stage enforcement uses artifact rules, with MATCH chaining each stage's products to the next stage's materials;
• the non-negotiable SLSA property: provenance is generated by the platform, never by the agent being governed — the same no-self-report principle as [0008].

Security detection uses the full-tree diff; incremental extraction is a performance/test-selection optimisation only — never the security key (a write nobody declares would otherwise never be reindexed, never diffed, never rejected).

3.2 Gate integrity and the admission contract

Gate integrity is an OS boundary, not a rule [0018]. Gate scripts, rulebase .pl, hook config, and the fact-promotion step run under a separate trusted user/runner, mounted read-only in the agent's view. The agent's git never performs promotion.

The gate implements the admission-control contract [0032]:

1. Ordered stages: mutate, then validate. The validating stage sees the mutated input. A MODIFY result may never be silently dropped; failing to apply a computed mutation is itself a gate failure. (Today tool_interceptor.py computes MODIFY and claude_governance_gate.py has no branch for it.)
2. Mutators are idempotent — no appending, counters, or timestamps in mutated content.
3. Every gate declares an explicit failure policy as data, not as an exception handler. The default is fail-closed [0002]. A gate declaring fail-open must state why, reviewably.
4. Undetermined ≠ allowed. Malformed input, engine error and timeout are outcomes distinct from ALLOW, recorded as such, resolved by the declared failure policy.
5. Self-exclusion is explicit. The operations required to diagnose or repair the governance path are declared and excluded, so a gate failure cannot make itself unrecoverable. This is the precondition that makes fail-closed survivable; the exclusion set is constitution-tier and human-ratified.
6. Every gate declares a timeout, resolved through the failure policy.

3.3 Liveness under fail-closed

Gate reads use a read-replica, and those reads must be causally consistent with the last promotion [0019] — a gate that reads a replica behind the promotion it is validating scores on a state that never existed. A transient graph/plumbing fault is park-with-fast-retry, distinct from a real red (escalate) — a single blip must not park the factory. Trunk merges run through a merge queue (the integrated re-gate is a serialisation point; it is scheduled, not contended).

Escalation: two axes (impl → model tier; design-gap/unsatisfiable → legislature); escalate on non-decreasing failing-check count over K attempts with the failure trail. (Note: the per-node token budget gate is the dominant backstop; the trend heuristic is a refinement, not the guarantee.)

4. Storage

Decision [0003, 0004, 0005, 0006]. (Supersedes the v0.1 designation "ADR-033-01" and the undocumented Memgraph choice it carried; see docs/adr/0003.)

1. The knowledge graph is the single system of record for facts; Prolog owns no durable facts [0005]. Memgraph (the Neo4j→Memgraph migration landed 2026-07-27; matches the live scripts/sync_ast_to_graph.py); per-project partitioning already exists via the project property [0003].
2. Facts keyed by (worktree, commit) [0004]; merge = fact promotion into trunk after the integrated re-gate; abandoned worktrees are GC'd.
3. Projection is rule-driven and completeness-checked [0006]: required predicates are derived by static analysis of the rule ASTs (transitively through the Prolog call graph), with any manual declaration used only as a cross-check; a meta-check asserts projection completeness before the rulebase runs. (NAF over a partial projection is unsound — an under-selected fact makes a violation vanish.) This analysis is decidable only because of the [0025] ban.

Rejected: separate Prolog fact-KB (duplication ⇒ drift); inference-in-Cypher (no recursive/NAF logic).

Note — incremental tabling already ships. knowledge.pl and kg_relevance.pl use SWI incremental tabling (:- table … as incremental) over dynamic … as incremental facts, so assert/retract invalidates exactly the affected table entries. This is load-bearing for [0027] and for B4b.

5. Test discipline

• REQ-033-T1 — Isolation + teardown. Prefer transaction-rollback over a pooled connection; explicit teardown for non-transactional resources.
• REQ-033-T2 — Fast + parallel by construction. Real Neo4j/Redis, function-scope fixtures, UUID-prefixed per-worker resources. Parallelism uses the repo's batched executor (scripts/run_tests.py) — NOT pytest -n auto (xdist is banned here; ~78% deadlock, enforced by an existing hook). Safe infra-test parallelism is its own task (B7).
• REQ-033-T3 — Budget. Full suite ≤ 6 min. Overrun ⇒ test-architecture redesign. Tiering (T4) is the primary lever, not a nicety.
• REQ-033-T4 — Tiered runs. Per write/rung: affected tests only (affected(Test) :- changed(Unit), traces(Test, Unit) + transitive deps). Whole suite only at the integration gate and pre-deploy.
• REQ-033-T5 — Anti-gaming (structural). Reject no-assertion tests, enumerated tautology patterns, non-assertion-covered coverage, and tests weakened to pass without an impl change (red-first ledger: per-commit test-AST + pass/fail history). Strength via mutation testing on the affected set (full mutation pre-deploy only). Known ceiling: mutation testing is implementation-relative — it cannot detect a self-consistent wrong pair; that is the job of anchors (§2) and interpretation mutation (§6).

6. Incompleteness detection (how we know a spec isn't ready)

The asymmetry [0011]: completeness is not provable; incompleteness is largely detectable. So DoR is "no detector fires", and the detectors run at design time, not mid-build. The measured ceiling for automated completeness checking is coverage ≈38% at precision ≈12% — which is why no detector in this section may issue a completeness verdict.

Detectors are ordered here by soundness, not by cost: the model-free detectors come first.

REQ-033-C1 — Assumption ledger + arbiter cascade (highest value; standalone; Phase 0)

Before build, the executing model SHALL enumerate every assumption it must make to proceed (the mechanised form of "I noticed I was about to guess"). Fable SHALL likewise disclose its interpretations (chosen reading + alternatives considered) per design node. (This converts human review from "infer semantics from a structure diagram" — rubber-stamp-prone — into "adjudicate N disclosed ambiguities".)

Matching an assumption to a pinning artefact is itself a semantic judgement, and the arbiter is specified [0024]. A three-stage cascade:

1. Deterministic pre-filter — lexical/structural matching against ACs, anchors and ADRs. A match here is provisional evidence, never sufficient alone.
2. Independent-tier adjudication for anything unresolved — performed by a tier that is not the author of the assumption; output is matched / unpinned / needs-human. It may not adjudicate its own enumeration.
3. Human adjudication for needs-human, or where stages 1 and 2 disagree. Adjudications are promoted into the Project KB [0014].

The model never issues a bare verdict on its own assumptions. Where a model is used it produces questions and candidate pinnings, never conclusions. (Rationale: LLM judging of requirement characteristics measures precision 0.13–0.50 at recall 0.74–0.89 — a high-recall hypothesis generator, not a verdict-giver.)

• AC-033-C1-01: Given a design, when the executor is asked to enumerate assumptions, then each is either matched to a pinning artifact (AC/anchor/ADR) or raised as a blocking question.
• AC-033-C1-02: Given an unpinned assumption, when DoR runs, then DoR fails and names the assumption and its design node.
• AC-033-C1-03: Given a Fable design, when ratification is requested, then the interpretation disclosure accompanies the diagram.
• AC-033-C1-04: Given an assumption resolved at stage 2, when the same assumption recurs in a later change, then the promoted adjudication resolves it without a second model or human pass.

REQ-033-C4 — Logical detectors (model-free; runs ahead of C2)

Promoted to first-class [0022] — where a declared formalization exists, C4 is the model-free sibling of C2 and has no generator-coverage limitation.

• Contradiction — Prolog unsatisfiability over the constraint set, run at design time.
• Under-constraint — the constraint set admits ≥2 materially different solutions ⇒ under-specified.
• Counterexample enumeration is required, not optional: a violation SHALL return the specific violating identifiers, not a boolean. (Same shape as the RTM integrity-constraint pattern: violation(req(R)) :- requirement(R), \+ (trace(R,T), test(T), proof_class(T,C), C >= min_class(R)).)

This implies specs should carry a declared formalization wherever practical — a real authoring cost with a deterministic payoff.

REQ-033-C3 — Lexical / structural detectors (tiered by measured precision)

Specified per [0029], derived from ISO/IEC/IEEE 29148 §5.2.7 with per-rule measured accuracy.

• Tier 1 — may block. Subjective language (P≈0.96), ambiguous adverbs/adjectives (0.81), loopholes and escape clauses (0.72), open-ended non-verifiable terms (0.70), weak modals, unresolved placeholders (TBD/TBR/???), missing units, exact duplicates, template violations, incomplete references.
• Tier 2 — advisory, never blocking. Superlatives (0.49), comparatives without a baseline (0.48), negative statements (0.33), non-atomic criteria, coordination and PP-attachment ambiguity, not-well-formed criteria, solution language.
• Tier 3 — question-generating only. Vague pronouns / anaphora (0.26), quantifier scope, operator placement (only/also/even), boundary words (up to, by vs until, open-vs-closed min/max), non-specific temporal words, under-specified head nouns, deictic references. These feed the C1 cascade; they never produce verdicts.

Three global rules, each derived from a measured failure:

1. Exempt conditional clauses from the comparative and negation detectors. (~48% of comparative false positives are harmless comparisons against absolute numbers inside a condition.) This requires clause structure — a DCG or parser, not a word list.
2. Optimise for recall; make dismissal cheap. Spell-checker presentation: inline, one-click dismissible, per-rule disable, persistent blacklist. A finding is an indicator, never a verdict.
3. Weight by location. Findings in a rationale clause ("so that…") are ~2× denser and empirically less relevant. Down-weight; do not suppress.

Plus the structural checks: undefined-term (terms absent from the glossary/ontology), unmapped requirement, orphan design node, node with no AC/anchor, dangling interface reference.

REQ-033-C2 — Interpretation mutation (intent-level; model-dependent; runs last)

Generate N plausible alternative readings of a requirement; derive what a faithful builder would produce under each; run the ratified tests + anchors. If the suite passes under an alternative reading, the requirement is under-specified there. Mutation testing asks "are tests sensitive to code changes"; this asks "are tests sensitive to meaning changes".

Per [0022], C2 requires adversarial separation or it satisfies itself:

• Anchors are ratified and frozen before C2 runs. C2 may never influence the artefact it is tested against.
• Readings are generated by a different tier, under adversarial framing — find a reading the anchors fail to exclude, not one that confirms the author.
• Inter-generator divergence is itself a signal: independent generators producing materially different reading sets means the requirement is ambiguous regardless of discrimination.
• A reading counts only if it is material — it must differ on some AC-observable output, or C2 can manufacture unlimited unfalsifiable readings and block indefinitely.

Stated ceiling (with the same prominence as T5's): C2 is generator-relative. It cannot surface a reading it does not sample. Its silence is a lower bound on ambiguity, never an upper bound on coverage — and its silence is anticorrelated with its usefulness, being quietest exactly when the model's posterior is confidently concentrated on one possibly-wrong reading.

• AC-033-C2-01: Given ≥2 material interpretations that the suite cannot discriminate, then DoR fails with the requirement and the indistinguishable readings.
• AC-033-C2-02: Given anchors not yet ratified, when C2 is invoked, then C2 refuses to run.

REQ-033-C5 — DoR is a construction procedure, not a checklist

DoR's completeness axes are retained in full and delivered as a construction procedure [0028]. A flat checklist is empirically no better than ad-hoc review (Porter/Votta/Basili, IEEE TSE 1995, replicated twice); only scenario-based reading — where the reviewer constructs an artefact — outperforms both. This matters more for us than for human review, because a model handed a checklist produces a plausible tick per row, whereas a construction step either produces its output or visibly cannot.

Ordered steps, each forcing a subset of the axes:

1. Enumerate the inputs. All specified? Any specified but unused?
2. Build equivalence classes and boundaries — ≥1 valid class and 2 invalid classes (below the low extreme, above the high extreme); for set membership, the set and its complement. Forces: input domain, empty/zero/absent, units and precision.
3. Write expected behaviour for every class, including every invalid class. Forces: error handling, output legality.
4. Walk the state machine — every state × every input, plus the no-input case. Forces: timeouts, applicability conditions, startup/shutdown/mode transitions, ordering, concurrency.
5. Walk the failure envelope — dependency down, slow, partially correct; retry; restart. Forces: graceful degradation, idempotency, durability.
6. Walk the limits — rate, size, count, time. Forces: capacity, latency, data age, pagination.
7. Answer the residual axes as forced choice — SPECIFIED (→ where) / N/A (→ why) / GAP; silence is not an allowed answer. Covers: measurable thresholds, authorization default, feedback loop, observability, the systematically-omitted non-functionals, time/timezone, encoding and locale, domain-ambiguity probe, external completeness, divergent-interpretation probe.

The construction output is a retained artefact, not a set of ticks. Steps 2–3 produce exactly the example and boundary anchors [0012] requires, so the cost is partly a prepayment on anchor authoring.

Axes carry provenance tiers so their authority is not overstated: [A] validated research (Leveson's completeness criteria, PBR, ISO 29148, Firesmith); [B] rigorous engineering literature outside RE (Waldo et al. on partial failure and concurrency; Saltzer & Schroeder's fail-safe defaults); [C] engineering convention with no formal source (idempotency/retry, pagination, timezone/DST, encoding/locale/collation) — marked honestly so a convention is never cited as a standard.

7. Threat model & failure posture

• Escape hatches are closed by content-exact full-tree matching + the registered-writer allowlist (§3.1) — not by enumerating bad commands. [0001, 0017]
• Provenance cannot be self-reported — attestations are generated by the platform, not the governed agent [0030]; declared-vs-actual materials checking makes the purity claim enforceable rather than asserted [0017].
• Gate integrity: OS-level separate user, read-only mounts, trusted-side promotion [0018].
• Fail-closed in factory mode under a declared failure policy; undetermined ≠ allowed; transient faults park-and-retry rather than escalate [0002, 0032].
• Self-exclusion is explicit and constitution-tier, so a gate failure cannot make itself unrecoverable [0032].
• Self-promotion is structurally impossible — merge requires a distinct identity [0033, 0018].
• Anchor laundering is closed by making anchors constitution-tier [0013] and by excluding anchor edits from the fast path [0023].
• Boundary-redefinition laundering is closed by treating component merge/split/move as loosening [0021].
• Egress: factory mode runs in an egress-denied sandbox. (Network exfiltration is runtime behaviour and is invisible to any filesystem diff; it cannot be claimed by the state mechanism.)
• SPOF: the graph is the single fact source; unavailability parks (fail-closed) with causally-consistent replica reads [0019] and retry to bound the blast radius.

8. Mapping to existing orchestrata (status-honest)

• Real & usable: @traces (core/base/traces.py, ~592 referencing files) · EscalationManager (kernel/pam/), consensus_required/quorum_met (agents/prolog_bridge.py, agents/coordinator.py) · SWI-Prolog 10.1.9 via janus (prolog_adapter.py) · 16 Prolog rulebases (~3,096 L) already honouring the ground-facts-only discipline [0005] · incremental tabling in knowledge.pl / kg_relevance.pl · tools/codebase_db.pl (20+ AST predicates over 695 modules / 7,857 symbols, incl. tool_impact/3 transitive blast radius, tool_dep_path/3, tool_cycles/2, tool_unused/2) · ast_query.py (813 L) · scripts/sync_ast_to_graph.py (schema/full/incremental/verify; project-scoped) · scripts/run_tests.py (batched executor) · arch-canvas + canvas skill · SPEC-064 git worktree tools.
• Real but thin / no-op today (→ tasks): claude_governance_gate.py + tool_interceptor.py (every path returns 0, including BLOCK; blanket except Exception documented as fail-open; no MODIFY branch at all despite InterceptorResult.modified_input → B18 [0032]) · intercept_bash.py (5-pattern regex) · prolog_gate.py (permissive when unloaded) · spec_completeness.pl (fact/string based) · QA anti-gaming heuristic (agents/volks/qa) · codebase_tools.py still shells out to subprocess swipl at ~0.3 s/query on a stale "janus unavailable on SWI 9.0.4" note → B25.
• Codegen SPEC-025 · impact SPEC-019 · tool exposure SPEC-072 · worktrees SPEC-064.

9. Build Status & Implementation Backlog (tasks, not gaps)

Table order is not build order; see Blocks/Phase.

Out of scope (Phase 3): federated external-model volks (they run outside the hook/state boundary; needs an executor-neutral gate protocol).

Phase 0 (now): B13 (assumption ledger + cascade), B23 (DoR construction procedure), B22 (C3 detectors) — all standalone, all improve every design immediately, none needs the graph or the gate. B19 (proof trees) is small and pays into everything after it. Phase 1 (thesis proof): B1a–B1c + B3 + B18 on one project against the existing Neo4j (per-commit full sync is acceptable; B4b not required) — prove an agent cannot merge untraced/nonconformant code without a human or model judging it. B18 is now Phase 1, not optional: without it the gate fails open and the thesis is untestable.

10. Visual

arch-canvas boards: governance-authority, build-pipeline, hook-governed-workflow.

11. Decision register

All decisions are recorded in docs/adr/ (ADR-0001 … ADR-0033) with context, rejected alternatives and consequences. ADRs 0001–0025 back-fill and harden the decisions implied by v0.1–v0.3; ADRs 0026–0033 come from the 2026-07-24 research swarm and the rulebase/gate survey. Five amend earlier records: 0026 amends REQ-106-066, 0027 settles the engine question left open in 0025, 0028 amends 0015, 0030 amends 0001 and 0017, 0032 amends 0002.

Related

• RTM page for 033-autonomous-build-factory
• All specs
• RTM overview
• Gates